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Abstract 

The standard approach to logic in the literature in philosophy and mathemat¬ 
ics, which has also been adopted in computer science, is to define a language (the 
syntax), an appropriate class of models together with an interpretation of formu¬ 
las in the language (the semantics), a collection of axioms and rules of inference 
characterizing reasoning (the proof theory), and then relate the proof theory to 
the semantics via soundness and completeness results. Here we consider an ap¬ 
proach that is more common in the economics literature, which works purely at 
the semantic, set-theoretic level. We provide set-theoretic completeness results for 
a number of epistemic and conditional logics, and contrast the expressive power of 
the syntactic and set-theoretic approaches. 


*This paper is almost identical to one that will appear in Annals of Mathematics and Artificial 
Intelligence in 1999. The work was supported in part by NSF under grant IRI-96-25901 and by the Air 
Force Office of Scientific Research under grant F49620-96-1-0323. A preliminary version of this work 
appeared in the Fifth International Symposium on Articial Intelligence and Mathematics, 1998. 



1 Introduction 


The standard approach to logic in the literature in philosophy and mathematics, which 
has also been adopted in computer science, is to dehne a language (the syntax), an 
appropriate class of models together with an interpretation of formulas in the language 
(the semantics), a collection of axioms and rules of inference characterizing reasoning 
(the proof theory), and then relate the proof theory to the semantics via soundness and 
completeness results. 

The economics literature has also been interested in various logics, particularly logics 
of knowledge and belief, and more recently conditional logic for counterfactual reasoning. 
By and large, they dispense with syntax altogether, working purely at a set-theoretic, 
semantic level. To understand how this is done, it is perhaps best to take as an example 
epistemic logic. 

Both approaches would start with what is called a frame in the logic literature, that 
is, a set W of possible worlds and a binary relation /C on W. Intuitively, {w, w') G /C if in 
world w, the agent considers w' possible.^ In the economics literature, the /C relation is 
used to dehne an operator K on events (subsets of W). Taking lC{w) = {w' : {w, w') G /C}, 
the operator K ; 2'^ i—>■ 2^ is dehned as follows: 

K{E) = {w : }C{w) C E}. (1) 

We read ^{E) as “the agent knows E”. 

The mathematical/philosophical approach adds an extra level of indirection to this 
more set-theoretic approach. A language for reasoning about knowledge is dehned, start¬ 
ing in the usual way with a set of primitive propositions, and closing oh under con¬ 
junction, negation, and applications of the modal operator K. As is well known, to 
give semantics to formulas in this language, we use a Kripke structure M = (IT,/C,7r), 
where (IT, /C) is a frame, and tt is an interpretation that associates with each primitive 
proposition and each world a truth value; that is, tt : <h x IT i—>■ {true, false}. We then 
dehne what it means for a formula (p to be true at a world w G IT, written (M, w) \= p, 
using the usual inductive dehnition.^ We can think of |= as just associating with each 
formula p an event \p\m = : {M,w) \= p} in structure M ([v?]m is called the inten¬ 

sion of p in the literature [Fagin, Halpern, Moses, and Vardi 1995]). Not surprisingly, 
= K(MAr); that is, we obtain the event associated with the formula Kp by 
applying the operator K to the event associated with p. 

If all that is done with a formula is to translate it to an event, why bother with the 
overhead of formulas and |=? Would it not just be simpler to dispense with formulas 
and interpretations, and work directly with events? Syntax often plays an important 
role—for example, it allows us to express concepts in a model-independent way. On the 

^Actually, in the economics literature, it is more standard to consider a partition of W; this is 
equivalent to the case where JC is an equivalence relation. 

^Readers unfamiliar with the definition can find details in Section 2. 
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other hand, if we have in mind an intended model all along, then perhaps it makes sense 
to just work directly with events. For example, the model-checking approach, which 
has been widely used in proving correctness of programs [Clarke, Emerson, and Sistla 
1986], typically works with one hxed model, the one generated by the program whose 
correctness we are trying to prove. Model checking has been advocated for epistemic 
reasoning as well [Halpern and Vardi 1991]. Perhaps when using the model-checking 
approach, it might make sense to work at the set-theoretic level. 

Probability provides another example. Probabilists start by dehning a particular 
model—the probability space of interest—and then investigating its properties. As the 
many texts on probability demonstrate, they have been able to prove a great many 
results about probability by working purely at a set-theoretic level. While some logics 
for reasoning about probability have been proposed, both propositional [Fagin, Halpern, 
and Megiddo 1990] and hrst-order [Halpern 1990], they certainly do not begin to capture 
all the subtleties of the reasoning we hnd in probability texts. For example, typical logics 
of probability cannot express notions such as expectation and variance. 

One of the apparent advantages of working with syntax is that we can define a proof 
theory, that allows us to manipulate formulas in order to prove properties of interest. We 
do not have to give up proof theory if we work at the set-theoretic level. For example, a 
standard property of knowledge is introspection: if an agent knows a fact, then he knows 
that he knows it, and if he does not know it, then he knows that he does not know it. 
Syntactically, these properties are expressed as 

• Kip ^ KKip, and 

• -iKip ^ K-iKip. 

These properties have immediate set-theoretic analogues: 

• K{E) C K(K(F)), and 

• -iK(F) C K(-iK(F)), where -i here denotes the set-theoretic complement. 

As this example suggests, we can translate a syntactic axiom to a set-theoretic axiom by 

1. replacing formulas by events, 

2. replacing the modal operator K by the set operator K, 

3. replacing the Boolean operations A, V by their set-theoretic analogues fl, U. 

In this paper, I explore set-theoretic completeness proofs in the context of epistemic 
logics and conditional logics. Both of these logics were introduced in the philosophical 
literature [Hintikka 1962; Stalnaker 1968], but have been widely used in computer science 
and AI. Epistemic logic has been used as a tool for analyzing multi-agent systems [Fagin, 
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Halpern, Moses, and Vardi 1995]; conditional logic has been used as a framework for 
analyzing nonmonotonic reasoning [Boutilier 1994] and counterfactual reasoning [Lewis 
1973]. It also has an important role to play in the analysis of causality [Lewis 1973], which 
is becoming an increasingly important issue in AI as well [Pearl 1995]. Set-theoretic 
completeness proofs for logics of knowledge and common knowledge are standard in the 
economics literature (see, for example, [Aumann 1989; Milgrom 1981]). I compare them 
to the more familiar syntactic completeness proofs in the philosophical literature, and 
then do the same for conditional logic. For the logics considered here, every syntactic 
operator has a semantic counterpart; thus, every property expressible syntactically has 
a semantic counterpart. However, as we shall see, the converse is not always true. For 
the logics considered here, the set-theoretic approach gives us extra expressive power, 
allowing us to express more properties. 

In part, this comes from the use of arbitrary (rather than just hnite) unions and 
intersections over events. We can already see the use of countable intersections and 
unions in the context of probability theory. Although probability is typically taken to 
be countably additive, this fact is not expressible in propositional logics of probability, 
although it can be expressed once we allow countable operations.^ To be precise, suppose 
that we have an operator of the form prP{(p) in the language, which is to be interpreted as 
“the probability of ip is at least p”, and a corresponding operator on events p^{E). The 
property of countable additivity cannot be expressed in a propositional logic, because we 
do not have countable disjunctions. Indeed, in [Fagin, Halpern, and Megiddo 1990], a 
complete axiomatization is given for a logic of probability where, semantically, probability 
is taken to be countably additive, but axiomatically, we require only hnite additivity. 
(This means that there will be nonstandard models of the theory where the probability 
is hnitely additive but not countably additive.) By way of contrast, countable additivity 
is immediately expressible using pP though, using countable unions: If Ei,i G / is a 
countable collection of pairwise disjoint sets, then countable additivity just says 

r\i(.ipF\Ei) c ^^(Uie/Ei), where p = 

In the case of knowledge, there is also a property that involves inhnite intersection. 
With only hnite intersection, we have: 

K(E) n K(E') = K(EnE'). (2) 

Once we allow inhnite intersections, we have 

r\jizjKi{Ej) = Ki{y\jizjEj) for any index set J and events Ej, j G J. (3) 

Clearly (3) implies (2). Somewhat surprisingly, it can be shown that if /C is an equivalence 
relation (that is, knowledge satishes the properties of S5), then they are equivalent. 

^For those readers unfamiliar with probability, finite additivity says that if E and F are disjoint sets, 
then Pt{E ij F) = Pr(if) -|- Pr(F). Countable additivity says that if Ei, E 2 , ■ ■ ■ is a sequence of pairwise 
disjoint sets, then Pr(Uiifi) = ^iPriEi). 
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(This follows from Aumann’s set-theoretic completeness proof [1989], although I provide 
a direct proof.) However, once we weaken the S5 properties, for example, if we consider 
either S4 or K45, then the equivalence no longer holds, and we need the full strength 
of (3) to get set-theoretic completeness proofs. At the syntactic level, this distinction is 
lost, because inhnite conjunctions cannot be expressed. 

Of course, it can be argued that if we extended propositional logic to allow inh¬ 
nite conjunctions, then these differences could be expressed perfectly well syntactically. 
However, issues of expressiveness do not arise only for inhnite conjunctions and disjunc¬ 
tions. In the context of conditional logic, I show that there are properties that involve 
only hnite intersections and unions that have no analogue at the syntactic level. More¬ 
over, even properties that can be captured syntactically are more naturally expressed 
at the set-theoretic level. Finally, as we shall see, completeness proofs seem to be more 
straightforward and transparent at the set-theoretic level, at least in the case of the logics 
considered here. 

The rest of this paper is organized as follows. In Section 2, I consider epistemic logic, 
while in Section 3, I consider conditional logic. I conclude in Section 4. 


2 Epistemic Logic 

I start by reviewing the syntactic approach to epistemic logic, and then I examine how 
the set-theoretic approach works. 

2.1 The Syntactic Approach: A Review 

For simplicity here, I consider single-agent epistemic logic; all the points I want to make 
already arise in the single-agent case. I briefly review the syntax and semantics here for 
those not familiar with it. We start with a nonempty set <F of primitive propositions, and 
close off under negation, conjunction, and applications of the modal operator K. Let 
be the language consisting of all formulas that can be built up this way. Thus, a typical 
formula in is K{^K{p Aq)). We dehne implication and disjunction as usual. 

A Kripke structure is a tuple M = (W,)C,n), as discussed in the introduction. We 
dehne (M, w) \= (phy induction as follows: 

{M,w) \= p (for a primitive proposition p G <F) iff 7r{w,p) = true 

(M, w) 1= p A p' iff (M, w) 1= p and (M, w) \= p' 

(M, w) 1= -ip iff (M, w) p 

{M,w) 1= Kp iff {M,w') 1= p for all w' such that {w,w') G 1C. 
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There are well-known soundness and completeness results for epistemic logic, that 
show the close connection between the assumptions we make about /C and axiomatic 
properties. Consider the following axioms: 

Prop. All substitution instances of tautologies of propositional calculus 
Kl. {Kip A K{(p ^jJ)) Kip, (Distribution Axiom) 

K2. Kip ip, (Knowledge Axiom) 

K3. Kip ^ KKip, (Positive Introspection Axiom) 

K4. -iKip K-iKip, (Negative Introspection Axiom) 

MP. From ip and ip ^ ip infer ip (Modus ponens) 

Gen. From ip infer Kip (Knowledge Generalization) 

The system with axioms and rules Prop, Kl, MP, and Gen has been called K. If we 
add K2 to K, we get T; if we add K3 to T, we get S4; if we add K4 to S4, we get S5; 
hnally, if we add K3 and K4 to K, we get K45. (Other systems can also be formed; 
these are the ones I focus on here.) 

Let M. be the class of all Kripke structures. We are also interested in subclasses of 
M. where the /C relation has various properties of interest. Let M.'' (resp., Ad’’*; AI®*; 
j\yfrst'j consist of the Kripke structures where the /C relation is reflexive (resp., reflexive 
and transitive; Euclidean^ and transitive; reflexive, symmetric, and transitive, i.e., an 
equivalence relation). 

Theorem 2.1: For formulas in the language : 

(a) K is a sound and complete axiomatization with respect to PA, 

(c) T is a sound and complete axiomatization with respect to FA'', 

(c) S4 is a sound and complete axiomatization with respect to 

(d) K45 is a sound and complete axiomatization with respect to 

(e) S5 is a sound and complete axiomatization with respect to 
■^A relation R is Euclidean if {s,t), {s,u) € R implies that {t,u) S R. 


5 



2.2 The Set-Theoretic Approach 


In the set-theoretic approach, we just start with a frame (hh, /C). We can then dehne an 
operator K as in Equation 1 in the Introduction. Consider the following properties of the 
K operator: 

Al. K{E) n K(E0 = K{EnE') 

A2. K{E) C E 
A3. K{E) C K(K(E)) 

A4. ^K(E) C K(^K(E)) 

A5. Dj^jK^Ej) = K(njgjEj) for any index set J and events Ej,j G 

A2, A3, and A4 are the obvious analogues of K2, K3, and K4, respectively. Al can be 
viewed as an analogue of Kl. In fact, it is not hard to show that 

Kl'. K{<^ A {K<^ A Kij) 

is equivalent to Kl in the presence of MP and Prop. We could have replaced Kl by Kl' in 
all the axiom systems and still have obtained all the completeness proofs of Theorem 2.1. 
Instead of Al, Aumann uses the monotonicity property 

AT. If E C F, the K(F) C K(F). 

It is easy to see that Al' follows from Al (since if F C F, then F fl F = F, so 
K(F) C K(F) n K(F) C K(F)). Al does not follow from Al', but it follows from 
Aumann’s set-theoretic completeness theorem that Al does follow from Al', A2, A3, and 
A4; Proposition 2.2 provides a self-contained proof of this fact. 

Note there is no analogue to Prop, MP, or Gen above; they turn out to be unnecessary 
at the set-theoretic level. (In particular, once we work at the level of sets, we do not 
need the Boolean equivalences encoded in Prop as axioms.) On the other hand, there 
is no analogue of A5 at the syntactic level; we cannot express inhnite conjunctions in 
propositional logic, so it is unnecessary. It turns out that A5 is also unnecessary if we 
assume that /C is an equivalence relation. This follows from the following result. 

Proposition 2.2: Any operator on events in W that satisfies Al', A2, and A4 must also 
satisfy A5 (and henee Al). 

Nf J = 0, we take the intersection over the empty set to be W, as usual. Thus, as a special case of 
this axiom, we get W = K{W). 
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Proof: Suppose K satisfies Al', A2, and A4. Consider the fixed points of K, that is, 
those sets E snch that K(i?) = E. \ first show that the set of fixed points of K is closed 
nnder negations and arbitrary nnions. 

Snppose K{E) = E. Then -^E = ^K(E), so K{^E) = K(^K(E)) = ^K{E) = ^E, 
where the second eqnality follows from A2 and A4. Thus, ^E is a hxed point of K. 

Next, snppose K(Ej) = Ej for all ?' in some index set J. Since E^ C by Al', we 

have K{Ej) C K{UjEj). Thus, 


UjK(ii/j) C KiyjjEj). 


(4) 


It now follows that 

K(U,ejE,) 

= K(UjgjK(i?j)) since Ej = K(i?j) 

C K(K(Ujeji?j)) by Al' and (4) 

C K(UjgjEj) by A2. 

Thus, K{Uj(zjEj) = KK{Uj(zjEj), and the set of fixed points of K is closed under arbitrary 
nnions. 

We are now ready to prove A5. Since HjtzjEj C Ej, it follows from Al' that 
K{y\j^jEj) C K{Ej). Thus, K{p\j(zjEj) C P\j^jK{Ej). For the opposite inclusion, observe 
that by A2, we have nj^jK{Ej) C Hj^jEj. Thus, by Al', K(njgjK(i?j)) C K{nj^jEj). 
By A2 and A4, -^V\{Ej) is a hxed point of K, for all j G J. Since the set of hxed points 
is closed nnder arbitrary unions and negations, Hj^jK^Ej) is also a hxed point of K. It 
follows that HjizjK^Ej) C K{p\j(zjEj), as desired. | 

Each of Al', A2, and A4 is necessary for Proposition 2.2. If we drop any of them, 
then A5 no longer necessarily holds, as the following examples show. 

Example 2.3: Let W = {1,2,3} and dehne Ko({l}) = Ko({2,3}) = 0, and Ko(E) = E 
for E 7 ^ (I), (2, 3}. It is easy to see that Kq satishes A2 and A4, bnt not Al' (since 
{3} C {2,3} but Ko({3}) = {3} ^ 0 = Ko({2,3})). Since Kq does not satisfy Al', a 
fortiori, it does not satisfy Al or A5. I 

Example 2.4: Let W = {1,2,3,...}. Dehne Ki(E) = E if E is cohnite (that is, 
if the complement of E is hnite) and Ki(E) = 0 otherwise. It is easy to see that 
Ki satishes Al (and hence Al') and A2, but does not satisfy A4 (since, for example, 
-iKi(-i{l}) = {1} 7 ^ 0 = K(-iK(-i{l})). Ki does not satisfy A5, since if Ej = “i{j}, then 

= K,({1}) = 0 7 ^ {1} = n,>,Ki(ii),). ■ 

Example 2.5: Let W = {1, 2, 3,...}. Dehne K 2 (E) = hF if E is cohnite and K 2 (E) = 0 
otherwise. Again, it is easy to see that K 2 satishes Al and A4, but does not satisfy A2 
(since, for example, K 2 (“i{l}) = W “'{I})- Taking Ej = “i{j} as in the previous 
example, note that K 2 does not satisfy A5 since K 2 {r]jEj) = tj) ^ W = r\jK 2 {Ej). | 


7 



The following theorem is the set-theoretic analogue of Theorem 2.1. Aumann [1989] 
proved it for the case that M G and K satisfies Al', A2-A4; this is a generalization 
of his result. (In light of Proposition 2.2, we can replace Al' by Al.) It is just the result 
we would expect (modulo, perhaps, the need for A5 if we do not have all of Al, A2, and 
A4). 

Theorem 2.6: The K operator in the frame (W,IC) satisfies A5. Moreover, if 1C is 
reflexive (resp., reflexive and transitive; Euclidean and transitive; an equivalence relation) 
then K satisfies A2 (resp., A2 and A3; AS and A4; A1-A4). Conversely, if K' is an 
operator on events satisfying A5, then there is a binary relation 1C on W such that K' 
is the K relation in the frame (W,)C). Moreover, if K' satisfies A2 (resp., A2 and A3; 
A3 and A4; AI-A 4 ), then fC is reflexive (resp., reflexive and transitive; Euclidean and 
transitive; an equivalence relation). 

Proof: The hrst part is straightforward and left to the reader. For the second part, 
given an operator K' on W, dehne fC so that lC{w) = C\{E : w G K'(i?)}. Using the 
fact that in all cases K' satishes A5, it is easy to check that K and K' agree. And just 
as in the standard canonical model constructions of completeness in the syntactic case 
(see, e.g., [Fagin, Halpern, Moses, and Vardi 1995]), we can show that A2 forces 1C to be 
reflexive, A3 forces it to be transitive, and A4 forces it to be Euclidean. The result follows. 
(Note that a reflexive. Euclidean, and transitive relation is an equivalence relation.) | 

This theorem is a typical example of a set-theoretic soundness and completeness 
result. The hrst part can be viewed as a soundness statement, while the second part 
gives us completeness. 

The reader familiar with the standard syntactic completeness proofs using canonical 
model constructions should hud it instructive to compare the set-theoretic completeness 
proofs with those involving canonical models. The set-theoretic proofs works for an 
arbitrary set W of worlds; we do not have to construct a special set where each world 
corresponds to a maximal consistent set of formulas. The dehnition of the 1C relation 
above is very similar in spirit to that in the canonical model construction, as are the 
arguments that A2, A3, and A4 force the 1C relation to be rehexive, transitive, and 
Euclidean, respectively. However, the proof that K = K' is simpler than the proof that 
a formula is true at a world in the canonical model if and only if it is an element of 
that world (viewed as a maximal consistent set of formulas). As we shall see, in the case 
of conditional logic, set-theoretic completeness proofs are also relatively simpler than 
syntactic ones. 

I have said we can view Theorem 2.6 as a set-theoretic soundness and completeness 
result. The standard soundness and completeness results in logic involve a language, 
a proof theory, and a semantics. Is there a way we can view Theorem 2.6 as a more 
standard soundness and completeness result? I briefly sketch here an argument showing 
that we can. 



Fix a finite set of worlds Wq. The set of event deseriptions (for Wq) is the least set 
formed as follows: We have a symbol A for each subset A of Wq, and close off under 
union, complementation, and applications of the K operator. Of course, we take Ei fl E 2 
to be an abbreviation for -i(-iEi U -1E2). A basic event formula (for Wq) has the form 
El = E 2 , where Ei and E 2 are event descriptions. Note that Ei C E 2 can be viewed as an 
abbreviation for the basic event formula Ei fl E 2 = Ei. An event formula (for Wq) is a 
Boolean combination of basic event formulas. Our language consists of event formulas. 
Note that the language is relative to the particular domain Wq about which we wish to 
reason. 

A semantic model for this language consists of an interpretation of K as an operator 
on subsets of Wq. This allows us to associate with each event description E a subset n(E) 
of ITo in the obvious way. Of course, each symbol A is interpreted as the corresponding 
subset A of ITo (that is, n(A) = A). Union and complementation get there standard 
interpretation, and the interpretation of K(E) is determined by the interpretation of K. 
Finally, a basic event formula Ei = E 2 is true relative to an interpretation if n(Ei) = n(E 2 ). 
Boolean combinations of event formulas are interpreted in the obvious way. 

As for the axiom system, besides considering A1-A4 (or some subset of these axioms), 
we need Prop and MP from the axiom system K for propositional reasoning, an axiom 
that says K(E) is equal to some subset of Wq, axioms describing the relationship between 
subsets of Wo, and axioms and inference rules for dealing with equality. The axiom that 
says K(E) is equal to some subset of Wq is simply 

A6. U^cwoK(E) = A. 

The axioms describing the relationship between subsets of Wq have the following form: 
for all subsets A,B,C C Wq, if AU B = C, then we have an axiom A U B = C; similarly, 
if B = -lA, we have the axiom B = -lA. Call this collection of axioms Rel. 

Finally, we need axioms that say equality is an equivalence relation (reflexive, sym¬ 
metric, and transitive), and an inference rule that allows us to substitute equals for 
equals. Call these three axioms and inference rule Eq. 

Let A be the axiom system consisting of Al, A6, Prop, MP, Rel, and Eq. 

Corollary 2.7: Let A' he a subset of A2, A3, Af. Then AuA' is a sound and complete 
axiomatization for the set of frames of the form (Wo,/C) where 1C satisfies the subset of 
{reflexive, transitive. Euclidean} corresponding to A'. 

Proof: Soundness is obvious. For completeness, it suffices to show that if (p is an 
event formula that is consistent with A U A! , then ip is satished in a frame (Wq, /C) 
where fC satishes the appropriate properties. But this follows almost immediately from 
Theorem 2.6. Extend (p fo a. maximal complete subset of event formulas. This set of 
formulas dehnes an operator K on events satisfying Al (and hence A5, since Wq is hnite). 
Thus, by Theorem 2.6, there is a binary relation 1C on Wq with the right properties. | 
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If Wf) is infinite rather than hnite, it seems that to prove a result like Corollary 2.7, we 
need to allow arbitrary unions rather than just hnite unions and arbitrary disjunctions 
(to express the analogue of A 6 ). I conjecture that a completeness proof exists even if we 
restrict the language to hnite disjunctions, although I have not checked details. In any 
case. Corollary 2.7 does show that it is legitimate to view Theorem 2.6 as a semantic 
counterpart of the more usual soundness and completeness results.® 


3 Conditional logic 

As I said earlier, conditional logic has been used to capture both counterfactual rea¬ 
soning and default reasoning. Stalnaker [1992] gives a short and readable survey of the 
philosophical issues involved. I briehy review the standard syntax and semantics here. 

3.1 The Syntactic Approach: Selection Functions 

As suggested above, the syntax for conditional logic is straightforward. We start with a 
set <h of primitive propositions, and close it oh under conjunction, negation, and applica¬ 
tions of the binary modal operator —Thus, if ip and ijj are formulas, then so is 99 
The formula p ^ tjj, can be read as “if p were the case, then ip would be true” (if we want 
to give —a counterfactual reading) or “typically/normally/by default, if p is the case 
then Ip is the case” (if we want to give it a reading more appropriate for nonmonotonic 
reasoning). Let be the set of formulas that can be built up this way. 

The original approach for capturing —due to Stalnaker and Thomason [Stalnaker 
1968; Stalnaker and Thomason 1970], proceeds as follows: Given a language £*", they 
assume that there is a selection function f : W x 1 —>• W. For counterfactual reasoning, 
we can think of f{w, p) as the world “closest” to w that satishes p. For default reasoning, 
/(tc, p) should be thought of as the most normal world (relative to w) satisfying p. These 
interpretations implicitly assume that there is a unique world closest to w (or most normal 
relative to w) that satishes E. Many later authors argued that there is not in general a 
unique closest world; ties should be allowed. I follow this interpretation here. Thus, I 
take a counterfactual structure to be a tuple (W,f,7i), where f : W x 1 —> 2^ and n 
is an interpretation, as before. 

The dehnition of |= in counterfactual structures is the same as that in epistemic 
structures, except for the clause for —which is 

{M,w) \=p^ip iff f{w, p) C IiP]m- 

This captures the intuition that the closest worlds to tc, as dehned by /, satisfy p. 
There are various restrictions we can consider placing on the selection function, 
thank Giacomo Bonanno for raising this issue. 
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51. c the worlds closest to w satisfying ip are in fact (/^-worlds (where w 

is a ip-world if tc G 

52. If f{w,ip) C and f{w,'ip) C \ip\M) then f{w,ip) = f{w,'ip). Stalnaker and 

Thomason [1970] view this as a uniformity condition. If the closest 99 -worlds all 
satisfy and the closest ■^^-worlds all satisfy ip, then the closest 99 -worlds and the 
closest ' 9 ^-worlds must be the same. Note that SI and S2 together force / to be a 
semantic function: if [ 99 ]m = [i/’Im, then, in the presence of SI, the antecedent to 
S2 will hold, so f{w,ip) = 

53. If tc G [99 ]m, then f{w,ip) = {tc}: if tc is a 99 -world, then it is the closest 99 -world 
to w. This restriction is particularly appropriate for counterfactual reasoning. It is 
not necessarily appropriate for nonmonotonic reasoning. The most normal 99 -world 
may not be w, even if tc is a 99 -world. 

5 4 . f{w, ip) is either empty or a singleton. This captures Stalnaker’s original assump¬ 
tion that there is a unique closest world, if there is a closest world at all. 

5 5 . f{w, ipi V 992) C f{w, ipi) U f{w, 992): if w' is one of the (991 V 992)-worlds closest to 
w, then it must be one of the 991-worlds closest to w or one of the 992-worlds closest 
to w. 

56. If f{w,ip) C \%Ij\m then f{w,ip A ■9^) C f{w,ip)\ if the closest 99-worlds to w all 
satisfy ip, then the closest 99 A ^^-worlds are all among the closest 99-worlds to wJ 

57. If f{w, ip) n \iP\m 7 ^ 0, then f{w, ip A ip) f{w, ip) fl \iP\m'- this is a strengthening 
of S5 (at least, when f{w,ip) 7 ^ 0), which says that the closest 99 A 9 ^-worlds to w 
are among the closest 99 -worlds that are also in \iP\m (provided there are any).® 

5 8 . If [99 ]m 7 ^ 0 then f{w, ip) 7 ^ 0: this says that there always is some 99 -world closest 
to w if there are any 99 -worlds. 

As we shall see in Section 3.3, if we introduce an ordering on worlds and dehne f{w,(p) 
as the 99 -worlds closest to w, then these restrictions arise by taking some very natural 
restrictions on the ordering (indeed, restrictions SI, S 2 , S5, and S 6 are forced on us). 

There is a well-known axiom corresponding to each of these conditions except for S 8 . 
Let 099 be an abbreviation for -199 — false and let Oip be an abbreviation of -l□-l 99 . 

^It may seem even more reasonable to replace C by = here. This would say that if the closest 
93 -worlds to w satisfy ip, then they are the closest 99 A i/)-worlds. In fact, the stronger version of S6 
already follows from SI, S2, and S5. (Proof: By SI, S2, and S5, f{w, 93 ) = f{w, (93 A 9 l>) V (93 A -'ip)) C 
f{w,ipAip)L)f{w,(pA-'ip). Moreover, if/(w, 93 ) C I 9 I 1 ], it follows from SI that/(ic, 93 )n/(r(;, 93 A-' 9 l’) = 0. 
Thus, f{w, ip) C f[ip A Ip).) Note that S2 can easily be obtained from SI and the stronger version of S6. 
I use the weaker version of S6 here because it allows us to make technical connections to some known 
results in conditional logic. 

®Again, we may want to strengthen C to =, and again, the stronger version follows from the weaker 
version, in the presence of SI, S2, and S5. 
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Thus, {M,w) 1= 0(p iff f(w,-'(p) = 0 and {M,w) \= Otp iff f{w,(p) ^ 0. Consider the 
following axioms: 

Prop. All substitution instances of propositional tautologies 

CO. {{(p %Iji) a (v? ^ %Ij 2 )) ^ ^ {%Iji a %Ij 2 )) 

Cl. p ^ p 

C2. {{p 'ip) ^ {'ll) ^ p)) ^ {{p -^a)^{'ip ^ a)) 

C3. p ^ {'ll) ^ {p ^ 'll)]] 

C4. {p ^ 'll)] \J {p ^ -^'ip) 

C5. {{pi -^'ip) ^ {p2 pj)) {{pi V P 2 ) 'ip) 

C 6 . {{pi P 2 ) A {pi 'ip)) ^ {{pi A P 2 ) 'ip) 

C7. (->(v 9 i ^ ^p2) A {pi 'ip)) ^ {{pi A P 2 ) 'ip) 

C 8 . (a) ^p ^ {p /\ {p' 

(b) <>p ^ {p' Op) 

MP. From p and p ^ 'ip infer tp 

RCl. From 'ip ^ 'ip' infer {p ^ 'ip) ^ {p ^ 'ip') 

All of the axioms other than C 8 above are familiar from the literature. In the language 
of [Kraus, Lehmann, and Magidor 1990], CO is the And Rule, Cl is Reflexivity, C5 is 
the Or Rule, C 6 is Cautious Mononotonicity, C7 is Rational Monotonicity, and RCl 
is Right Weakening. In [Kraus, Lehmann, and Magidor 1990] the focus was default 
reasoning, for which CO, Cl, C5, C 6 , C7, and RCl are considered appropriate. C 2 , C3, 
and C4 come from the literature on counterfactual reasoning; they are A 6 , t4.9, and t4.7 
in [Stalnaker and Thomason 1970], respectively. There is one other rule considered in 
[Kraus, Lehmann, and Magidor 1990] called Left Logical Equivalence, which says 

LLE. Erom p ^ p' infer {p ^ 'ip) ^ {p' —> 'ip) 

This is true if / is a semantic notion, which depends only on \p\m) and not the syntactic 
form of p. As we have observed, this follows from SI and S2. Not surprisingly, LLE 
follows readily from Cl, C2, and RCl. We can also obtain C2 from CO, Cl, C5, C 6 , 
RCl, and LLE, with a little effort, thus C2 holds in the framework of [Kraus, Lehmann, 
and Magidor 1990]. 

C 8 is intended to characterize S 8 . Basically, we want to say that if [ 99 ]]^ 7 ^ 0 (i.e., p 
is satishable somewhere in structure M) then Op must be valid in M (that is, true at 
every world in M). Equivalently, if M \= Up, then -^p must be unsatisfiable in M. The 
following discussion may help explain how C 8 captures this. 

Given a structure M = {W,f,n), dehne w' to be reachable from w via p if w' E 
f{w,p). We can then inductively dehne reachability via a sequence pp,.. .-jp^. If /c > 1, 
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w' is reachable from w via cpi,... ] if there exists w" such that w' is reachable from w" 
via ifk and w" is reachable from w via (pp ,...; (pk-i- Finally, we say that w' is reachable 
from w if it is reachable via some sequence of formulas. Notice that (M, w) \= ipi 
{ip 2 —>(••• {<Pk —> 9 ?)...)) if v? is true at every world w' reachable from w via ipp,... ;ipk. 

Lemma 3.1: Suppose C8 is valid in M. 

(a) If {M,w) \= □</?, then {M,w') |= A □(y? for every w' reachable from w via any 
sequence of formulas. 

(b) If{M,w) 1= Oip, then {M,w') \= Oip for every w' reachable from w via any sequence 
of formulas. 

Proof: For part (a), note that part (a) of C 8 says that if {M,w) \= □</?, then {M,w') \= 
□99 for every world w' reachable from w via (ph Inductively, it follows that (M, w') \= 
for every world w' reachable from w via any sequence of formulas. Since C 8 also tells us 
that ^ 99 is valid, this means that (p is true at all worlds reachable from w via any 
sequence of formnlas. Part (b) follows similarly from part (b) of C 8 . I 

As the following theorem shows, the observation in Lemma 3.1 is enongh to essentially 
force S 8 .® 

Theorem 3.2: Let S be a (possibly empty) subset of {SI, ..., S8} and let C be the 
corresponding subset of [Cl, ..., C8}. Then {Prop,CO,MP,RCl} U C is a sound and 
complete axiomatization for the language CP with respect to the class of counterfactual 
structures satisfying the conditions in S. 

Proof: As usnal, sonndness is straightforward. While the basic ideas of the completeness 
proof are standard (and go back to [Stalnaker and Thomason 1970]), I sketch some of 
the details here, since this resnlt is somewhat more general than the ones that appear 
in the literatnre. I assnme that the reader is familiar with the standard canonical model 
arguments from the literature. 

For completeness, we must show that every consistent formula is satishable. Suppose 
that 990 is consistent. We hrst consider the case that C8 ^ C. 

Let W consist of all the maximal consistent sets of formulas in £^. Let g : W x 1 —> 
2^ be dehned via g{w,ip) = G w}. Dehne a selection / on hF so that 

®In the presence of Cl, C5, C6, RCl, and LLE, C8 can be expressed in more familiar terms. It is 
easy to see that in the presence of Cl, C5, C6, RCl, and LLE, Diy ^ (tp ^ ip) is valid. (Proof: From 
Cl, we have (pAtp) (pAtp). By RCl, we have (pAtp) p. From -ny ^ false (□(/?) and RCl we have 
-ly ^ p and ^p ip. From C6, we get that ^pAip p. Now by C5, we get {{^pAip) V [ip A ip)) p. 
Finally, by LLE, we get ip p.) Thus, C8 follows from {Up =^> A p)) A {Op ^ UOp). This is 

a conjunction of two axioms denoted R (for reflexivity) and U (for uniformity) by Lewis [1973]. The 
converse holds as well; this follows from Theorem 3.2. 
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f{w,(p) = {w' : g{w,(p) C w'}, and define an interpretation tt snch that n{w,p) = true 
iff p G ta. Let M = (hh, /, tt) . 

We can now prove the usnal Truth Lemma-, for every formula G we have 
(M, ta) 1= (p iff (p G ta. We proceed by induction; the only nontrivial case comes if p has 
the form ipi —> 'ip 2 - If t/’i t /’2 G w, we want to show that {M,w) |= —> 'ip 2 - Thus, 

we must show that f{w,'ipi) C By dehnition, = {w' : g{w,'ipi) C w'}. 

Since t/’i —^ t /’2 G w, it follows that 'ip 2 G g{w,'ipi), so C {w' : '^2 G By the 

induction hypothesis, {w' : 'ip 2 G w'} = Thus, {M,w) |= '^1 —> 'ip 2 , as desired. 

For the opposite direction, suppose {M,w) |= '^1 —> 'ip 2 - Thus, f{w,'ipi) C ['^ 2 ]m- It 
follows that ip 2 must be provable from the formulas in g{w, ip), for otherwise there would 
be a world w' containing g{w,ipi) and -''^ 2 , and tc' would be in f{w, ['i/’iIm) — [t/’ 2 ]M, 
by the induction hypothesis. Thus, there is a hnite set of formulas in g{w,ipi), say 
{(Ti,..., (Tfc}, such that (Ti A ... A (jfc '^2 is provable. Since ipi ^ aj E w, j = 1,..., k, 
it follows from CO that ipi {ai A ... A a^) G w. Now applying RCl, we get that 
ipi ^ ip 2 ^ w, as desired. 

It follows that (fo is satisfiable in M. 

Now we have to show that / satishes all the properties in S. The arguments are 
straightforward. I consider three representative cases here. 

Cl: Suppose that Cl G C. We want to show that SI holds. Thus, we must show that 
f{w,p) C Ip]m. By dehnition, if tc' G f{w,p), then g{w,(p) C w'. If Cl holds, 
then if G g{w,ip). Thus, if w' G f{w,(p), then ip G w'. By the Truth Lemma, 
w' G [(p]m- 

C4: Suppose that C4 G C and f{w, ip) 7 ^ 0. We want to show that f{w, <p) is a singleton. 
Suppose that Wi 7 ^ W 2 are both in f{w,ip). Thus g{w,ip) (L wiP\W 2 . There must 
be some formula ip such that ip E Wi and -^ip E W 2 . It follows from C4 that either 
{M,w) \= ip ^ Ip or {M,w) 1= —> -^ip. In the former case, ip E g{w,(p), while in 

the latter case, ->ip E g{w, ip). Either way, it follows that g{w, (p) — tci n tC 2 7 ^ 0, a 
contradiction. 

C 6 : Suppose C 6 G C and f{w, ip) C \iP\m- We want to show that f{w, ipAip) C /(tc, ip). 
Suppose that w' E f{w, ip A ip). This means that g{w, ip A ip) C w'. To show that 
w' E f{w,ip), we need to show that g{w,ip) C w'. But if a G g{w,ip), then 
ip ^ (7 E w. By C 6 , it follows that {ip A ip) ^ a E w, so a E g{w, ip A ip). Since 
g{w, ip Alp) w', it follows that a E w'. Thus, g{w, ip) C w', as desired. 

Finally, we must deal with the case that C 8 G C. Let Wq be a world in M such that 
ipo E Wq. (Recall that ipQ is the formula which we are trying to show is satishable.) Let W 
consist of all worlds in W reachable from wq. It is almost immediate from the dehnitions 
that if w' E W, then f{w', ip) C W' for all formulas ip. Let f and tt' be the restrictions 
of / and TT to W, respectively, and let M{wq) = {W, f ,ti'). The Truth Lemma holds 
for W'-, the proof above goes through without change. Similarly the arguments that all 
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the properties in S other than S8 hold in M{wq) go through without change. Thus, (po 
is satishable in M{wo), and all the properties in S other than S also hold in M{wq). 

To see that S 8 also holds in M{wo), suppose that [v7]m(u>o) 7 ^ 0- want to show 
that f{w,ip) 7 ^ 0 for all w G hh', or equivalently, that {M{wo),w) \= Op. Since all 
worlds in W are reachable from wq, there must be two sequences of worlds, Wi,... ,Wk 
and Wq,w[, ..., and two sequences of formulas, pi,... and p[,..., 99 ^ such that 
Wk = w, Wq = Wq, {M (wq), w'^) \= p, Wj is reachable from wj-i via pj, for j = 1,..., k, 
and Wj is reachable from Wj_i via p'j from j = 1,... ,m. We must have {M{wo),Wq) \= 
Op, for otherwise, by dehnition, we have {M{wo),Wq) \= ^-^p, and it would follow by 
part (a) of Lemma 3.1 that {M{wf)),w'^) |= -^p, a contradiction. Since w'q = wq, we 
have that {M{wq),wo) |= Op. Now aplying part (b) of Lemma 3.1, it follows that 
{M{wo),Wk) 1= Op. Since Wk = tcj we get the desired result. I 

3.2 The Set-Theoretic Approach: Selection Functions 

In the set-theoretic approach, rather than having a syntactic operator —we have a 
binary operator on events (the superscript e stands for event); that is 2^ x 2^ — 
2 '^. For ease of exposition, I write H E instead of {H, E). Intuitively, w G H E 
if, at world w, if H were to hold, then so would E. Again, we can give semantics to 
using selection functions, but since we no longer have formulas, we replace the formula 
that is the second argument in the syntactic case by a set of worlds (which we can think 
of as the intension of a formula). Thus, a (set-theoretic) selection function maps W x 2^ 
to 2^. 

A (set-theoretic) counterfactual structure is then a pair M = (IF, f), where IF is a set 
of worlds and f is a set-theoretic selection function. 

We can then dehne the binary operator 2^ x 2^ 1 —>■ 2^ in M as follows: 

H ^ E = {w ■^{w,H)(ZE}. (5) 

We can define restrictions on f completely analogous to those dehned in the syntactic 
case. These are listed below, along with one additional restriction, S9'. 

SF. ^{w,H) C H 

S2'. If f{w, H) C H' and ^{w, H') C H, then f{w, H) = f{w, H') 

S3', li w & H, then f{w, H) = {tc} 

S4'. f{w, H) is either empty or a singleton 
S5'. f{w, Hi U H2) C f{w, Hi) U f{w, H2) 
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S 6 '. If f{w, H) C E then f{w, H f] E) C f[w, 

Sr. If f{w, hf) n E ^ 0, then f{w, H f] E) C f{w, H) f] E 
S 8 '. If if ^ 0 then f{w, H) ^ dl 

S9'. If f(w, H) C E 1 UE 2 , then there exist Hi, H 2 such that H 1 UH 2 = H, f{w, Hi) C Ei, 
and f(ta, H 2 ) C E 2 

S9' has no analogue in the syntactic case. Since S5' is easily seen to be equivalent to 
“if there exist Hi,H 2 such that HiU H 2 = H, f{w,Hi) C Ei, and f{w,H 2 ) C E 2 , then 
f (tc, H) EiU E 2 ”, S9' can be viewed as a converse to S5'. It is also not hard to see that 
S9' follows from SI' and S7'. (Proof: if iP fl i7i 7 ^ 0 and H Ci E 2 ^ then we can take 
Hi = H n El and H 2 = H D {E 2 U -^Hi); ii H D Ei = ij), we can take Hi = 0 , 7^2 = E, 
and similarly if iP fl 7^2 = 0 -) As we shall see, S9' arises (along with SI', S 2 ', S5', and 
S 6 ') when the selection function f is induced by an ordering on worlds. 

Each of these restrictions corresponds to an axiom, completely analogous to C0-C8. 
Consider the following axioms: 

CO', fljej(iP -H. = }j rijgjEj for any index set J and events Ej,j G J 

Cl'. {H ^H) = W 

C2'. {H A H') n {H' A iP) n (i/ A E) C {H' A E) 

C3'. Hr}{H^E) = Hr}E 

C4'. {H ^ E)VJ{H ^ ^E) = W 

C5'. (Hi A E) n (H 2 ^E)C (Hi UH2)^E 

C 6 '. (H A El) n(H^ E2) C(Hn El) A E2 

cr. ^(H A ^Ei) n (hr A ^ 2 ) c(Hn Ei) A E 2 

C 8 '. hrA0 = 0ifhr^0 

C9'. H^(EiU E2) c U^H„Hr.HiUH,=H}((Ei ^ El) H (H2 A E2)) 

We can now state and prove the semantic soundness and completeness result. 

Again, the stronger version, with C replaced by equality, follows from SI', S2', and S5', using 
arguments almost identical to the earlier ones. Similarly, a stronger version of S7' follows from SI', S2', 
and S5'. 
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Theorem 3.3: Let S be a (possibly empty) subset of {Sf, ..., Stf}, let C be the eor- 
responding subset of {Cl',..., CtL}, and let W be a set of worlds. If f is a set-theoretic 
selection function on W that satisfies the conditions in S and is defined in {W, f) by (5), 
then satisfies CO and the axioms in C. Conversely, if the function 2^ x 2^ i—> 2^ 
satisfies CO and the axioms in C, then there is a selection function ^ on W satisfying S 
such thatis the counterfactual operator in 

Proof: It is easy to check that if f satishes the conditions in S, then A satisfies CO' and 
all the conditions in C. For the second half, given a function 2^ x 2^ i—> 2^ that 
satishes CO' and the axioms in C, dehne f(tc, JL) = r\{E ■. w & H ^ E{. I leave it to the 
reader to check that ^ is the counterfactual operator in (IF, f) and satishes S. I 

Again, a number of points are worth making. First, observe how C8' captures S8' 
far more directly than C8 captures S8. We did not have to struggle to hud an axiom 
corresponding to this condition. Next, observe that the completeness proof proceeds in 
somewhat the same spirit as the syntactic completeness proof, but avoids the construc¬ 
tion of a canonical model. It works whichever model we start with. An analogue to 
Corollary 2.7 can also be proved, showing that, again, we are entitled to view Theo¬ 
rem 3.3 as a soundness and completeness result. Finally, as I now show, we need the full 
strength of CO' for completeness. 

Consider the obvious hnitary analogue of CO': 

CIO'. {H A El) n (77 A Es) = 77 A (Ei n E 2 ) 

I actually give two examples showing that we cannot in general replace CO' with CIO'. 
The hrst is a simple example that satishes Cl'-C3', C5'-C10', but not CO' (or C4'). Then 
I give a somewhat more sophisticated example that satishes all of Cl'-ClO', but not CO'. 
Since A must satisfy CO', this shows that CIO' does not suffice, even in the presence of 
all the other properties. 

Example 3.4: Let IF = {1,2,3,...}. Dehne ^ so that if tc G 77, then w G H E 
iS w G E] a w ^ H, then tc G 77 E ih (a) E fl -lE = 0 or (b) H is inhnite and 
En-iE is hnite. I leave to the reader the somewhat tedious (but straightforward) task of 
checking the ^ satishes Cl'-C3', C5'-C10'. It does not satisfy CO', since if Ej = 
then El El = IF and Ei Ej = Ej for j = 2, 2, 3,.... But CjEj = 0, Ei 0 = 0, 

and Hj^Ei ^ Ej) = {1}. Thus, CO' does not hold. Note that ^ also does not satisfy 
C4' since, for example, ({1, 2} {1}) U ({1, 2} “’ll}) = (1, 2} 7 ^ IF. | 

Example 3.5: For this example, we need to review some material on hlters and ultrahl- 
ters [Bell and Slomson 1974]. A filter on IF is a nonempty set U of subsets of IF that is 
closed under supersets (i.e., \i E and E C E', then E' G U) and hnite intersections, 
and does not contain the empty set. An ultrafilter is a maximal hlter, that is, a hlter that 
is not a subset of any other hlter. A principal ultrafilter is an ultrahlter which consists of 


17 



all the supersets of a particular element of W. (It is easy to check that this is indeed an 
ultrafilter.) A nonprincipal ultrafilter is an ultrafilter that is not a principal ultrafilter. 
Note that if U is an ultrafilter, then for any set H, either H or -iH must be in U. From 
this it follows that if FT G W, then for any set E, we must have that one oi H r\ E oi 
H n -^E is in U. (Proof: If neither is in W, then H, U E, and -liF U -^E are all in U. 
Since U is closed under hnite intersections, it follows that tj) ^ U. This contradicts the 
fact that F/ is a hlter.) 

Let F/ be a nonprincipal ultrahlter on hF = {1, 2, 3,...}. (Nonprincipal ultrahlters on 
W can be shown to exist using Zorn’s Lemma.) Dehne as follows: w E H E if 
and only if the following conditions hold: 

(a) if tc G FF, then w E H (1 E, 

(b) if w ^ H and H eU, then H H E E U, 

(c) if w ^ H and FF ^ F/, then FF = 0 or min(FF flF^) = min(FF) (where min(F^) denotes 
the minimal element of E). 

Again, it is straightforward (but tedious) to show that satishes Cl'-ClO'. For example, 
to see that C4' holds, we must show that, for all E, we have (FF F?)U(FF -lE) = W. 
We do a case-by-case analysis. If tc G FF, then, by clause (a), then if w E E, we also have 
w E H E, by definition; otherwise, w E H -^E. If tc ^ FF and H Ehl, then one of 
H n E or H n -iF? must be in F/, since otherwise, since U is an ultrahlter, we would have 
both -iFFUF? G U and -iHU-<E E FF, from which it follows that -iFF G U, contradicting the 
assumption that H eU. Finally, if tc ^ FF and FF ^ FF, then either min(FF) = min(FFnF?) 
or min(FF) = min(FF fl —lE). In all cases, we have w E (FF E) U (FF -.E). 

To see that does not satisfy CO', note that a nonprincipal ultrahlter can contain 
only inhnite sets, and so must contain all cohnite sets. Taking the sets Ei as in Exam¬ 
ple 3.4, it follows that Ei and EiHEj are both in FF, for all i,j (since these are all cohnite 
sets). It then follows from the dehnition that Ei Ei = W and Ei Ej = Ej. Thus, 
we get a violation of CO' just as in Example 3.4. | 

3.3 Preferential Orders 

I have described f{w,ip) as the “closest” worlds to w satisfying 99 . This suggests that 
there is an underlying ordering on worlds. Lewis [1973] made this intuition explicit as 
follows. A preferential frame is a pair (hF, FF), where FF is a ternary preferential relation 
on a set W of possible worlds. For technical reasons that will be discussed at the end 
of this subsection, I assume that W is hnite in this subsection. We typically write 
w' w" rather than R{w,w',w"). This should be thought of as saying that w' is at 
least as close to w as tc"; thus, represents the “at least as close to w” relation. Let 
Ww = {w' : 3w"{w' tc")}. We can think of W^, as the domain of . Intuitively, 

the worlds not in W^, are so far away from w that they cannot even be discussed. As 
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would be expected from the intuition, we require that be a partial preorder on 
that is, a reflexive, transitive relationd^ We dehne the relation by taking w' -<^ w" 
if w' w” and not(tc" w'). 

Given our intuitions regarding closeness, the following requirements seem reasonable: 

PI. tc G Ww and is the minimal element with respect to (so that w is closer to itself 
than any other element): formally, for all w' G W^, we have w :<^ w and w w'. 

P2. is a total preorder on Ww- that is, for all w',w" G W^, either w' :<^ w" or 
w" w'. 

P3. is a linear order on W^,-. that is, for all w',w" G W^,, if tc' 7 ^ tc", then either 
w' w' or w" w'. 

P4. W^ = W for all w G W 

In a preferential frame, we can dehne a (set-theoretic) selection fnnction G such that 
G(tc, H) are the worlds closest to w, according to that are in H. Formally, we have 

G(n;, H) = {w' e H nWy, ■. if w" w' then w” i H}. 

This gives ns a way of dehning a binary operator in preferential frames, by an imme¬ 
diate appeal to Dehnition (5). 

We can also dehne a syntactic version (which is actnally what Lewis did). A prefer¬ 
ential strueture is a tnple M = (IF,i?, tt), where (hF, i?) is a preferential frame and tt is 
an interpretation. Ronghly speaking, we would now like to dehne a syntactic selection 
fnnction in M by taking 

/^(w. If) = {w' G Iflu n 14G, : if w" -<^ w' then w" ^ (6) 

and then use this selection fnnction to give semantics to conditional formulas. The only 
problem is that we have not yet dehned [flu- The formal dehnition does not use the 
selection fnnction directly. Nevertheless, it is easy to check that the formal dehnition is 
consistent with this intnition. 

Formally, the dehnition of |= in preferential strnctures is the same as that in connter- 
factnal strnctnres, except for the danse for —>•, which is 

{M,w) h ^ ^ if Mm) C [f)]M 

This is well-dehned, since the indnctive dehnition of |= gnarantees that the sets \f\M 
and have already been dehned. This dehnition makes precise the intnition that 

^^Note that is not necessarily anti-symmetric. That is why it is a preorder, not an order. Nor is 
it necessarily total; totality is forced by condition P2, which will be defined shortly. 
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If ^ Ip holds at world w if the v?-worlds closest to w (according to the ordering used 
at w) all satisfy tp. 

The following syntactic completeness result is well known. It says that in preferential 
structures, —> satishes CO, Cl, C2, C5, C6, and RCl; moreover, PI, P2, P3, and P4 give 
us C3, C7, C4, and C8, respectively. 

Theorem 3.6: [Burgess 1981; Friedman and Halpern 1994; Lewis 1973] Let V he any 
(possibly empty) subset of {P1,P2,P3,P4} letC he the corresponding subset of {C3,C7,C4,C8}, 
and let W be a finite set of worlds. Let he the class of preferential structures where the 

ternary relation R satisfies the conditions inV. ThenCU{Prop, CO, Cl, C2, C5, C6, MP, RCl} 
is a sound and complete axiomatization for the language CP for the class of preferential 
structures in 

What about set-theoretic completeness? Not surprisingly in the light of the previous 
theorem, it turns out that satishes SI', S2', S5', S6'; moreover, PI, P2, P3, and P4 
correspond to S3', S7', S4', and S8', respectively. The interesting thing is that we also 
get S9'. 

Lemma 3.7: Let V he a subset of {P1,P2,P3,P4}, and let S be the corresponding subset 
of {Sf',S7,S4',38'}. If (hP, R) is a preferential frame satisfying the properties in V, then 
R satisfies SI', Slf, 35', 36', 39' and all the properties in S. 

Proof: Proving that R satishes all the properties is straightforward. I consider only S9' 
here. To see that satishes S9', suppose H) P EiU E 2 . Let E'^ = EiD f{w, H), 
for j = 1,2. Let E^ consist of all the elements in H that are at least as far from w 
as some element in Ej. That is, E^ = {w' G H : G E'j{w" tc')} Then dehne 

= (Efi - (E' - E()) U{H - WP and H 2 = (E^ - - E!^)) U (77 - Wp. It is 

not hard to show that 77 = 77i U 772. (Proof: By construction, C 77, so we must 
have 77i U 772 C H. For the opposite containment, note that if n G 77 — Ww, then the 
construction guarantees that v G 77i fl 772- Also note that 77' fl P Ef, since if n G E'^ 
then n G 77j n 77 and if n G then v fiC v. Thus, 77j C Hj for j = 1,2. Finally, if 
n G 77 n Ww — (77( U T?^), then choose v' G fy(tc, 77) such that v' fiC v. Such a v' must 
exist by dehnition, n' G 77 by construction, and n' G 77i U E 2 since R(tc, 77) C 77i U 772- 
If v' G Ej, then we must have v G E^ and hence v G Hj.) 

It remains to show that C{w,Hj) <7 Ej, j = 1,2. I consider the case that j = 1. 

(The proof for j = 2 is almost identical.) Suppose that v G C{w,Hi). Thus, v G 
Efi — {E '2 — 77(), since C{w,Hi) C W^. Since v G Efi, there exists some v' G 77( such 
that v' fiP V. Since, as we observed above, 77( C 77i, we have v' & Hi. Thus we cannot 
have v' v, for otherwise v ^ P{w,Hj). Thus, v fiC v'. It follows that v G p{w,H), 
for otherwise there would be some v" G 77( U 77^ such that v" v. This would mean 

^^Note that since Cl, C5, C6, RCl, and LLE all hold (recall that LLE follows from Cl, C2, and RCl), 
we can replace C8 by the simpler [Uip ^ A y)) A (Oy DOy). 
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that v" -<^ v', contradicting the fact that v' G E[. Thus, it follows that v G E[U E!^. 
Since v E Hi, we cannot have v E E'^ — E[. Hence v E E[, as desired. | 

We then get the following set-theoretic soundness and completeness result. Note that 
we can use CIO' instead of CO', since we are restricting to hnite sets of worlds. 

Theorem 3.8: Let V he any (possibly empty) subset of {Pl,P2,P3,Pf}, let C be the 
corresponding subset of {C3',C7,C4',C8'}, and let W be a finite set of worlds. If R is a 
ternary relation on W that satisfies the conditions in V then satisfies Cl', C2', C5', 
C6', CP, Clff, and all the axioms in C. Conversely, if 2^ x 2^ i—> 2^ and satisfies 
Cl', CP, C5', C6', CP, ClP, and the axioms in C, then there is a ternary relation R 
on W satisfying the conditions in V such that ^ is the counterfactual operator in 
{W,R). 

Proof: The first half (soundness) follow immediately from Lemma 3.7 and Theorem 3.3. 
For the second half, suppose that satishes Cl', C2', C5', C6', C9', CIO', and the 
axioms in C. First assume that C7' ^ C. Dehne w' P'" w" iff tc G {w',w"} 
and w ^ {tc', w"} ^ 0. (This way of dehning the ordering is essentially due to [Kraus, 
Lehmann, and Magidor 1990]; a slightly different ordering for the case that C7' is in C is 
described at the end of the proof.) We must show that pP is a partial order on and 
that the operator determined by this relation agrees with The following lemma 
will prove useful; 


Lemma 3.9: H4, = {w' : w ^ {tc'} 0}. 


Proof: Let W' = {tc' : w ^ {w'} ^ 0}. If w' E W', then 
Cl', we must have w E {tc'} {la^}) and thus w' E Ww 

there must be some w" such that w' pP w". Thus, 

we have w' pP w' (since, by 
Conversely, if w' E W^, then 

w E {w', w"} ^ {tc'} 

(7) 

and 

w ^ {tc', w"} ^ 0. 

Suppose, by way of contradiction, that 

(8) 

w E {tc'} 0. 

(9) 

From CO' and (9), it follows that 


w E {tc'} {w"}. 

(10) 

By Cl', we have 

w E {w"} ^ {w"}. 

(11) 
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By C5' applied to (10) and (11), we have 


w E {w', w"} ^ {w"}- (12) 

Finally, from CIO' applied to (7) and (12), we get w E {w', w"} ^ 0. Bnt this contradicts 

( 8 ). ■ 

It follows immediately from Cl' and Lemma 3.9 that :<^ is reflexive on Ww To show 
that it is transitive, it is easy to see that it snffices to show that if Ei, E 2 , E^ are disjoint 
sets, then 

((F/i U F/2) F/i) n {{E2 U F/3) F/2) C ((F/1 U F/3) F/i). 

(Transitivity follows easily from the special case that Ej = {tCj}, j = 1,2,3, where Wi, 
W 2 , and W 3 are different worlds.) 

For the proof, it is usefnl to have two preliminary lemmas. 

Lemma 3.10: If E E E' then H ^ E E H ^ E'. 

Proof: If C 77', then by CIO' we have 

{H ^ E)n{HE') = H{E HE') = HE. 

I 


Lemma 3.11: {Hi ^ Ei) fl {H2 ^ E2) E {Hi U H2) ^ {Ei U 7 ^ 2 ). 

Proof: Using Lemma 3.10 and C5', we have 

{Hi 77i)n(772 E 2 ) C {Hi (77iU772))n(772 (T'iU772)) C {H 1 UH 2 ) (77iU772). 

I 


From Lemma 3.11, we have that 

(( 77 i U E 2 ) El) n {{E 2 U 7^3) E 2 ) C {El U E 2 U 7^3) ( 77 i U E 2 ) (13) 

Applying Cl' and Lemma 3.11, we also get 

( 77 i U E2) El = {{El U E2) El) n {E^ E^) C ( 77 i U E2 U E^) {Ei U E^) ( 14 ) 

Finally, using (13), (14), CIO', and C6', we get 

(( 77 i U E2) El) n {{E2 U 7^3) E2) 

C {{El U E2 U 773) {El U Ef)) n {{El U E2 U E^) {Ei U E^)) 

= ((T/i U E2 U 773) El) n ((F/i U E2 U 773) {El U F/3)) 

C ( 77 i U 773) 77 i. 
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Thus is transitive, as desired. 

Next, we must show that C3', C4', and C8' give us PI, P2, and P4, respectively. 
(Recall that I have deferred the case of C7'.) 

Suppose that ^ satisfies C3'. Then {tc} fl ({tc} 0) = 0, so tc ^ {ta} 0; thus, 
w G Ww by Lemma 3.9. Moreover, since {w^w'} fl {it’}) = we have 

w w' for all w' G 144), showing that PI holds. 

If satishes C4', then (using Cl' and CIO'), we have 

W = {w', w”} ^ {tc'} U {w', w”} {W — {tc'}) 

= {tc', w"} ^ {tc'} U ({tc', w"} ^ {W — {tc'}) n {w', w"} ^ {w', w"}) 

= {w', w"} {«;'} U {w\ w"} {w"}. 

It easily follows that for all w',w" G II4, we have either w' :<^ w" or w" w'. Thus, 
P2 holds. 

Finally, it is immediate from the dehnitions that if satishes C8', then II4 = W. 

It remains to check that and agree. We prove that 

H (15) 


Note that Cl', C2', C5', C6', and CIO' hold for both 4 and For 4, this follows 
from the hrst half of the theorem; for it follows by assumption. These are the only 
properties used in the proof. Note that this means that Lemmas 3.10 and 3.11 apply to 
both 4 and 

Using CIO' and Cl', we have that H E = H {H fl E), and similarly for 
thus, we can assume without loss of generality that E C H. We proceed by induction 
on \E\. (Here we are making heavy use of the fact that W is hnite.) If = 0, then if 
IP = 0, the result follows from Cl'. If FT 4 0; then for each w' G H, we have 

H 0 = ((/f 0)n(iF K})) c K} 0. 


Thus, we have 


iF 0 C ^ 0. 


By C5', we actually have 

iF 0 = P\w'£h{w'} ^ 0. 

An identical argument works if we replace by Thus, it suffices to show that {tc'} 

0 = {tc'} 0. But, by Lemma 3.9, w G {tc'} 0 iff w' ^ H4. It is also immediate from 

the dehnitions that w' ^ H4 iff tc G {tc'} 0. Thus, {w'} ^ 0 = {tc'} 0, as desired. 

If \E\ = 1, suppose E = {tc'}. We proceed by a subinduction on |iF|. If |FF| = 1, 
then the result is immediate from Cl', since C FF. If |FF| = 2, let H = {w',w"}. 
li H ^ E, there are a number of cases to consider. First suppose that w',w" G H4. 
Then w G {w', w"} 4 {la'} iff w' w", which implies w G {w', w"} {w'} by 
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definition. If w' ^ then,by Lemma 3.9, we have w G 0- By Cl', we have 

w G {w"} ^ {w"}. Now by Lemma 3.11, we have w G {w',w"} ^ {w"}. By CIO', it 
follows that w G {w', w"} ^ 0. By the induction hypothesis, we have w G {w', w"} 0, 

and by Lemma 3.10, we have w G {w', w"} as desired. Finally, if w” ^ 134), then 

tc G {w"} 0. By the induction hypothesis, we have tc G {w''} -4 0, and by Cl', we 

have tc G {tc'} Now by Lemma 3.11, we have w G {tc',tc"} -4 {tc'}, as desired. 

For the converse, note that if tc G {tc', w''} -4 {tc'}, then either w' w" or w" ^ 134)- 
If tc' tc", then we have tc G {w',w"} ^ by dehnition, while if w" ^ B4,, then 
by Lemma 3.9, we have w G {w''} ^ 0. Since, by Cl', we also have w G {tc'} 
the desired result follows from Lemma 3.11. 

To complete the subinduction, suppose \H\ >2. If tc G FT then by 

Lemma 3.10, we also have w E H {tc', tc"} for all tc" G H. Thus, by C6', w G 

{w', w"} ^ {tc'} for all w" G H. By the induction hypothesis, we have w G {w', w"} 

{tc'} for all tc" G H. By C5', we have w E H ^ A symmetric argument works for 

the converse (replacing the roles of -4 and ■^). 

Finally, suppose \E\ > 1. Choose some w' E E. By C9', we have that \iw E E[ E, 
then w E {Hi {E — {w'})) fl {H 2 -4 {tc'}) for some Hi, H 2 such that iFi U iF 2 = H. 

By the induction hypothesis. Hi E — {tc'} = Hi ^ E — {tc'} and H 2 -4 {tc'} = H 2 ^ 

{tc'}. By Lemma 3.11, Hi E — {tc'} Ci H 2 {tc'} <E H ^ E. Thus, w E H E. 
The opposite containment is obtained by a symmetric argument. 

Now we must deal with the case that C7' G C. The argument is similar in spirit to 
that given in [Friedman and Halpern 1998]. In this case, :<^ is not necessarily a total 
order. However, we can show that is modular, if wi -<^ W 2 , then for all W 3 E Ww, 
either ws W 2 or wi -<^ W 3 . To see this, suppose wi W 2 and it is not the case that 
W 3 W 2 . Then 

w E {wi,W 2 }{wi} (16) 

and 

w ^ { 102 , 103 }{ws}. (17) 

Since w E {tcs} from (16) and Lemma 3.11 it follows that 

w G {wi, W2, W 3 } ^ ws}- (18) 

We also must have 

w E {wi,W 2 , W 3 } {rr’i}, (19) 

for otherwise, we have w E “'({tci, W 2 ,-i-i{tci}), so by C7' and (18), we would 
have 

w G {^ 2 ,^ 3 } ^ {rr’i,W3}- (20) 

Since we also have w E { 102 , 103 } ^ {t(; 2 ,W 3 }, an application of CIO' gives us tc G 
{^ 2 , 1 ^ 3 } -4 {tC 3 }, contradicting (17). From (18), (19), and C6', we immediately get 

w E { 101 , 103 }{wi}. (21) 
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We also cannot have w G {^1,^3} {it’a}, for then by CIO' and (21), we would 

have w G {tcijtca} 0. From Lemma 3.10, we then would get w G {tai,ta3} {1^3}, 
and from C6', that w G {^3} 0, contradicting the assumption that W 3 G hF^. We can 
therefore conclude, using (21), that wi -<^ W 3 , giving us the desired modular order. 

Once we have a modular order, we can easily dehne a total order from it. Dehne 
tc' w" either if w' w" or neither w' w" nor w" -<^ w' hold. It is a standard 
result (and not hard to show) that is a total order if is modular. (See [Halpern 
1997, Lemma 2.6] for a proof.) Moreover, it is easy to see w' <"' w" iff w' w". Thus, 

/< = /^, so that if we use to dehne the ternary relation, our previous argument 
shows that —and still agree. This completes the proof of Theorem 3.8. Although 
the proof is certainly nontrivial, it is still signihcantly simpler than the corresponding 
syntactic proof (see, for example, [Burgess 1981; Friedman and Halpern 1994]). | 

I conclude with some remarks on the case that W is inhnite. In this case, there may 
not be a “closest” world to w satisfying ip. As a result, the dehnition of —used here 
based on an ordering gives counterintuitive results. It is perhaps easier to understand 
this issue in semantic terms, using the selection function f^. For example, let W°° = 
{0, 1 , 2 ,..., cx)} and for all f, we have i + 1 -<°° i, that is, f + 1 is closer to 00 than i. 
Then ii H = W — {cxd}, we would have fo(cxD, 77) = 0 and cx) G 77 A 0 according to the 
dehnition above, because there is no world “closest” to cx) in 77. This does not accord 
with the usual intuitions for -h.. 

This particular problem disappears if we require to be well-founded, which means 
that there are no inhnitely descending sequences of the form .. .Wn Wn-i A"' 
■ ■ ■ Wo, as is essentially done by Kraus, Lehmann, and Magi dor [1990]. Lewis gives a 
dehnition that seems to give us the properties we want even if is not well-founded. 
Roughly speaking, his dehnitions says that ip ^ ip holds at w if all worlds sufficiently 
close to w that satisfy ip also satisfy ip. More precisely, Lewis dehnes —as follows. Given 
a preferential structure M = {W, R, n), we have 

{M,w) \= ip ^ Ip , ii ioi every world Wi G there is a world W2 such that 

(a) W2 wi (so that W2 is at least as close to tc as tci), (b) W2 G [99 A 

and (c) for all worlds W2, we have tcs G I99 iP\m (so any world closer 

to w than than W 2 that satishes ip also satishes ip). 

It is not hard to show that Lewis’s dehnition coincides with that given here if -< is well- 
founded (and, in particular, if W is hnite). Moreover, with this dehnition. Theorem 3.6 
holds even if W is inhnite (except that P3 has to be strengthened to require that be 
well founded as well as linear in order to get it to correspond to C4). Thus, it seems that 
by taking Lewis’s dehnition, we get precisely the properties we want. 

Unfortunately, as results of [Friedman, Halpern, and Roller 1996] show, appearances 
here are somewhat deceiving. Lewis’s dehnition is still not appropriate for counterfactual 
or nonmonotonic reasoning in inhnite domains, once we have a rich enough language. In 


25 



[Friedman, Halpern, and Koller 1996], the language considered is first-order conditional 
logic, but the problems can be demonstrated using the set-theoretic approach as well. 

We can easily dehne an operator that captures Lewis’s dehnition, although it 
does not correspond to a selection function. For example, CO' does not hold with this 
dehnition in general (even though it does hold if is dehned in terms of a selection 
function). Consider the domain fF°° above, and let = {k, k + 1, k + 2,...}. Then we 
have oo E Hq Hk for all k, but since = 0, we have {Hq = 0. 

The fact that CO' does not hold in general is not bad. It is not clear that we want it for 
counterfactual and nonmonotonic reasoning in the inhnite case. For example, consider 
a lottery. If we think of Ej as corresponding to “player j wins the lottery” and J as 
being the set of players, then we might well want to have Dj^jiW ~^Ej), which just 
says that, for each player j in J, normally player j does not win the lottery (giving a 
normality reading) and, in addition, W -E (^Uj^jEj), which says that normally someone 
wins the lottery. But this is incompatible with CO'. 

While Lewis’s dehnition does not force CO', results of [Friedman, Halpern, and Koller 
1996] show that other properties do hold with Lewis’s dehnition that are arguably just as 
undesirable as CO' in the inhnite case. For example, it is easy to show that the following 
property holds, for any index set J: 

((U,eji/,) ^ -i/i) n n,ej((i/i u H^) A H,) = 0. (22) 

(22) encodes a variant of the lottery paradox. Consider a lottery with J players, where 
player 1 has bought more tickets than any other player. It might then seem reasonable 
to say that player 1 is more likely to win than any other player, but still unlikely to 
win. If we think of Hi as corresponding to “player i wins the lottery” and we give -E ^ 
“typicality” reading, then this is exactly what the left-hand side of (22) says. However, 
the fact that the right-hand side is the empty set says that this situation cannot happen, 
according to Lewis’s dehnition. 

As shown in [Friedman, Halpern, and Koller 1996], there is another approach that 
can be used for giving semantics to conditional logic that involves plausibility measures 
[Friedman and Halpern 1998], which works appropriately even for hrst-order conditional 
logic (with inhnite domains). Of course, this approach too can be captured by a set- 
theoretic approach, but the details of that would take us well beyond the scope of this 
paper. 


4 Conclusion 

The goal of this paper is to show that we can still get the beneht of an axiomatic proof 
theory even if we work at the semantic level. Indeed, at the semantic level we may 

J is finite, then (22) follows easily from C5', C8', and CIO'. It would follow from an infinitary 
version of C5' if J is infinite, but the infinitary version of C5' does not follow from the other properties. 
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get more axioms and easier completeness proofs. This should not be interpreted as an 
argument to abandon the more traditional, syntactic approach. Syntactic methods have 
their place, particularly when we do not have one hxed model in mind about which we 
are reasoning. However, these results are further evidence showing that when we are 
working with a hxed model, semantic reasoning can be a powerful tool. 


Acknowledgements: I would like to thank Giacomo Bonanno and the two anonymous 
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